Impossible Traveler Response
This playbook handles impossible traveler alerts. An Impossible Traveler event occurs when multiple login attempts seen for a user from multiple remote countries in a short period of time, which shouldn't be possible. This may indicate the account is compromised. **Attacker's Goals:** Gain user-account credentials. **Investigative Actions:** Investigate the IP addresses and identities involved in the detected activity using: * Impossible Traveler - Enrichment playbook * CalculateGeoDistance automation **Response Actions** The playbook's first response actions are based on the data available within the alert. In that phase, the playbook will execute: * Manual block indicators if the IP address found malicious * Manual disable user * Manual clear of the user’s sessions (Okta) When the playbook continues, after validating the activity with the user’s manager, another phase of response actions is being executed, which includes: * Auto block indicators **External Resources:** [Impossible traveler alert](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Analytics-Alert-Reference/Impossible-traveler-SSO)
Core · 26 tasks · 28 inputs · 21 outputs
Details
| ID | Impossible Traveler Response |
|---|---|
| From Version | 6.6.0 |
| Tasks | 26 |
README
This playbook handles impossible traveler alerts.
An Impossible Traveler event occurs when multiple login attempts seen for a user from multiple remote countries in a short period of time, which shouldn’t be possible. This may indicate the account is compromised.
Attacker’s Goals:
Gain user-account credentials.
Investigative Actions:
Investigate the IP addresses and identities involved in the detected activity using:
- Impossible Traveler - Enrichment playbook
- CalculateGeoDistance automation
Response Actions
The playbook’s first response actions are based on the data available within the alert. In that phase, the playbook will execute:
- Manual block indicators if the IP address found malicious
- Manual disable user
- Manual clear of the user’s sessions (Okta)
When the playbook continues, after validating the activity with the user’s manager, another phase of response actions is being executed, which includes:
- Auto block indicators
External Resources:
Dependencies
This playbook uses the following sub-playbooks, integrations, and scripts.
Sub-playbooks
- Containment Plan
- Impossible Traveler - Enrichment
- Ticket Management - Generic
Integrations
This playbook does not use any integrations.
Scripts
- impossibleTravelerGetDistance
- Set
- CreateArray
Commands
- closeInvestigation
- setParentIncidentFields
Playbook Inputs
| Name | Description | Default Value | Required |
|---|---|---|---|
| MaxMilesPerHourAllowed | The maximum miles per hour that is considered reasonable. If the geographical distance and difference in time between logins is greater than this value, the user will be considered an impossible traveler. | 400 | Optional |
| WhitelistedIPs | A comma separated list of IP addresses that are allowed to be used across long distances. | Optional | |
| ContactUserManager | Whether to ask the user manager for the legitimacy of the login events, in case of an alleged impossible traveler. | True | Optional |
| AutoContainment | Whether to execute auto containment. | False | Optional |
| AbuseIPDBThreshold | The score needed from AbuseIPDB to consider IP address as malicious. | 80 | Optional |
| preInvestigationContainment | Whether to execute containment prior investigation phase | Optional | |
| AllowlistCIDR | A comma separated list of CIDR that are allowed to be used across long distances. | lists.CIDR - Allowlist | Optional |
| username | The username to iterate over. | alert.username | Optional |
| domain | The organization domain. | Optional | |
| ShouldOpenTicket | Whether to open a ticket automatically in a ticketing system. (True/False). | False | Optional |
| serviceNowShortDescription | A short description of the ticket. | XSIAM Incident ID - ${parentIncidentFields.incident_id} | Optional |
| serviceNowImpact | The impact for the new ticket. Leave empty for ServiceNow default impact. | Optional | |
| serviceNowUrgency | The urgency of the new ticket. Leave empty for ServiceNow default urgency. | Optional | |
| serviceNowSeverity | The severity of the new ticket. Leave empty for ServiceNow default severity. | Optional | |
| serviceNowTicketType | The ServiceNow ticket type. Options are “incident”, “problem”, “change_request”, “sc_request”, “sc_task”, or “sc_req_item”. Default is “incident”. | Optional | |
| serviceNowCategory | The category of the ServiceNow ticket. | Optional | |
| serviceNowAssignmentGroup | The group to which to assign the new ticket. | Optional | |
| ZendeskPriority | The urgency with which the ticket should be addressed. Allowed values are “urgent”, “high”, “normal”, or “low”. | Optional | |
| ZendeskRequester | The user who requested this ticket. | Optional | |
| ZendeskStatus | The state of the ticket. Allowed values are “new”, “open”, “pending”, “hold”, “solved”, or “closed”. | Optional | |
| ZendeskSubject | The value of the subject field for this ticket. | XSIAM Incident ID - ${parentIncidentFields.incident_id} | Optional |
| ZendeskTags | The array of tags applied to this ticket. | Optional | |
| ZendeskType | The type of this ticket. Allowed values are “problem”, “incident”, “question”, or “task”. | Optional | |
| ZendeskAssigne | The agent currently assigned to the ticket. | Optional | |
| ZendeskCollaborators | The users currently CC’ed on the ticket. | Optional | |
| description | The ticket description. | ${parentIncidentFields.description}. ${parentIncidentFields.xdr_url} | Optional |
| addCommentPerEndpoint | Whether to append a new comment to the ticket for each endpoint in the incident. Possible values: True/False. | True | Optional |
| CommentToAdd | Comment for the ticket. | ${alert.name}. Alert ID: ${alert.id} | Optional |
Playbook Outputs
| Path | Description | Type |
|---|---|---|
| Account.Email.Address | The email address object associated with the Account. | string |
| DBotScore | Indicator, Score, Type, Vendor. | unknown |
| Account.ID | The unique Account DN (Distinguished Name). | string |
| Account.Username | The username of the Account. | string |
| Account.Email | The email address associated with the Account. | unknown |
| Account.Type | The type of the Account entity. | string |
| Account.Groups | The groups that the Account is a part of. | unknown |
| Account | Account object | unknown |
| Account.DisplayName | The display name of the Account. | string |
| Account.Manager | The manager of the Account. | string |
| DBotScore.Indicator | The indicator value. | string |
| DBotScore.Type | The indicator’s type. | string |
| DBotScore.Vendor | The indicator’s vendor. | string |
| DBotScore.Score | The indicator’s score. | number |
| IP | The IP objects. | unknown |
| Endpoint | The Endpoint’s object. | unknown |
| Endpoint.Hostname | The hostname to enrich. | string |
| Endpoint.OS | The Endpoint OS. | string |
| Endpoint.IP | The list of Endpoint IP addresses. | unknown |
| Endpoint.MAC | The list of Endpoint MAC addresses. | unknown |
| Endpoint.Domain | The domain name of the Endpoint. | string |
Playbook Image
Inputs
MaxMilesPerHourAllowed— The maximum miles per hour that is considered reasonable. If the geographical distance and difference in time between logins is greater than this value, the user will be considered an impossible traveler.WhitelistedIPs— A comma separated list of IP addresses that are allowed to be used across long distances.ContactUserManager— Whether to ask the user manager for the legitimacy of the login events, in case of an alleged impossible traveler.AutoContainment— Whether to execute auto containment.AbuseIPDBThreshold— The score needed from AbuseIPDB to consider IP address as malicious.preInvestigationContainment— Whether to execute containment prior investigation phaseAllowlistCIDR— A comma separated list of CIDR that are allowed to be used across long distances.username— The username to iterate over.domain— The organization domain.ShouldOpenTicket— Whether to open a ticket automatically in a ticketing system. (True/False).serviceNowShortDescription— A short description of the ticket.serviceNowImpact— The impact for the new ticket. Leave empty for ServiceNow default impact.serviceNowUrgency— The urgency of the new ticket. Leave empty for ServiceNow default urgency.serviceNowSeverity— The severity of the new ticket. Leave empty for ServiceNow default severity.serviceNowTicketType— The ServiceNow ticket type. Options are "incident", "problem", "change_request", "sc_request", "sc_task", or "sc_req_item". Default is "incident".serviceNowCategory— The category of the ServiceNow ticket.serviceNowAssignmentGroup— The group to which to assign the new ticket.ZendeskPriority— The urgency with which the ticket should be addressed. Allowed values are "urgent", "high", "normal", or "low".ZendeskRequester— The user who requested this ticket.ZendeskStatus— The state of the ticket. Allowed values are "new", "open", "pending", "hold", "solved", or "closed".ZendeskSubject— The value of the subject field for this ticket.ZendeskTags— The array of tags applied to this ticket.ZendeskType— The type of this ticket. Allowed values are "problem", "incident", "question", or "task".ZendeskAssigne— The agent currently assigned to the ticket.ZendeskCollaborators— The users currently CC'ed on the ticket.description— The ticket description.addCommentPerEndpoint— Whether to append a new comment to the ticket for each endpoint in the incident. Possible values: True/False.CommentToAdd— Comment for the ticket.
Outputs
Account.Email.Address— The email address object associated with the Account.DBotScore— Indicator, Score, Type, Vendor.Account.ID— The unique Account DN (Distinguished Name).Account.Username— The username of the Account.Account.Email— The email address associated with the Account.Account.Type— The type of the Account entity.Account.Groups— The groups that the Account is a part of.Account— Account objectAccount.DisplayName— The display name of the Account.Account.Manager— The manager of the Account.DBotScore.Indicator— The indicator value.DBotScore.Type— The indicator's type.DBotScore.Vendor— The indicator's vendor.DBotScore.Score— The indicator's score.IP— The IP objects.Endpoint— The Endpoint's object.Endpoint.Hostname— The hostname to enrich.Endpoint.OS— The Endpoint OS.Endpoint.IP— The list of Endpoint IP addresses.Endpoint.MAC— The list of Endpoint MAC addresses.Endpoint.Domain— The domain name of the Endpoint.
Commands used
closeInvestigation
setParentIncidentFields
Flowchart
id: Impossible Traveler - Enrichment version: -1 name: Impossible Traveler - Enrichment description: |- This playbook get as an input all of the involved IP addresses and identities from the Impossible Traveler playbook alert, and enriches them based on the following: * Geo location * Active Directory * IP enrichment e.g. VirusTotal, AbuseIPDB, etc. starttaskid: "0" tasks: "0": id: "0" taskid: 7ccb9fd5-4d10-49ab-89c8-a920b9547981 type: start task: id: 7ccb9fd5-4d10-49ab-89c8-a920b9547981 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "28" separatecontext: false view: |- { "position": { "x": 450, "y": -865 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "1": id: "1" taskid: 26e7340f-7890-4435-8c78-04ad7fcbafca type: condition task: id: 26e7340f-7890-4435-8c78-04ad7fcbafca version: -1 name: Is there account to be enriched? description: Checks whether there is a username for the offending user in context, and whether Active Directory v2 is enabled. type: condition iscommand: false brand: "" nexttasks: '#default#': - "27" "yes": - "29" separatecontext: false conditions: - label: "yes" condition: - - operator: isExists left: value: simple: incident.username iscontext: true right: value: {} view: |- { "position": { "x": 450, "y": 110 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "9": id: "9" taskid: f38df01f-6b55-466a-8bce-2e98b9b287d0 type: title task: id: f38df01f-6b55-466a-8bce-2e98b9b287d0 version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false view: |- { "position": { "x": 450, "y": 940 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "13": id: "13" taskid: 8f0bc025-3ee1-42b3-8f04-524a31b916df type: regular task: id: 8f0bc025-3ee1-42b3-8f04-524a31b916df version: -1 name: Get coordinates for the IP Addresses description: Sends an HTTP request. Returns the response as Json. scriptName: http type: regular iscommand: false brand: "" nexttasks: '#none#': - "14" scriptarguments: method: simple: GET url: simple: http://ip-api.com/json/${inputs.sourceip} separatecontext: false view: |- { "position": { "x": 450, "y": -570 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "14": id: "14" taskid: eb064458-d034-4248-89a9-3fac30ef7520 type: regular task: id: eb064458-d034-4248-89a9-3fac30ef7520 version: -1 name: Parse HTTP response JSON description: 'Parse a given JSON string "value" to a representative object. For example: ''{"a": "value"}'' => {"a": "value"}.' scriptName: ParseJSON type: regular iscommand: false brand: "" nexttasks: '#none#': - "15" - "16" - "19" - "24" - "26" scriptarguments: extend-context: simple: Coordinates= ignore-outputs: simple: "true" value: complex: root: HttpRequest.Response accessor: Body transformers: - operator: Stringify separatecontext: false view: |- { "position": { "x": 450, "y": -410 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "15": id: "15" taskid: f03e3aee-72d7-456e-8c29-48df8ffadc9b type: regular task: id: f03e3aee-72d7-456e-8c29-48df8ffadc9b version: -1 name: Set Location description: Sets a value in context under the key you entered. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "22" scriptarguments: append: simple: "true" key: simple: Events.location value: complex: root: Coordinates accessor: lat transformers: - operator: append args: item: value: simple: Coordinates.lon iscontext: true - operator: join args: separator: value: simple: ', ' separatecontext: false view: |- { "position": { "x": 50, "y": -230 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "16": id: "16" taskid: 31b0887a-17b7-4446-8ae3-9286cb07a564 type: regular task: id: 31b0887a-17b7-4446-8ae3-9286cb07a564 version: -1 name: Set Event Time description: Sets a value in context under the key you entered. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "22" scriptarguments: append: simple: "true" key: simple: Events.event_timestamp value: complex: root: alert accessor: created separatecontext: false view: |- { "position": { "x": -340, "y": -230 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "18": id: "18" taskid: 8ae6b224-d274-49e6-8665-43b78bdd5b6d type: regular task: id: 8ae6b224-d274-49e6-8665-43b78bdd5b6d version: -1 name: Delete HTTP Response Context description: |- Delete field from context. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: DeleteContext type: regular iscommand: false brand: "" nexttasks: '#none#': - "9" scriptarguments: all: simple: "no" key: simple: HttpRequest.Response separatecontext: false view: |- { "position": { "x": 850, "y": 770 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "19": id: "19" taskid: 817a6f83-aad4-46a2-8035-4e4778523de7 type: regular task: id: 817a6f83-aad4-46a2-8035-4e4778523de7 version: -1 name: Set IP Address description: Sets a value in context under the key you entered. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "22" scriptarguments: append: simple: "true" key: simple: Events.ip value: complex: root: Coordinates.query filters: - - operator: isEqualString left: value: simple: Coordinates.query iscontext: true right: value: simple: inputs.sourceip iscontext: true ignorecase: true separatecontext: false view: |- { "position": { "x": 450, "y": -230 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "21": id: "21" taskid: 1d06af95-318b-4397-8dbb-72b52f36f0a2 type: regular task: id: 1d06af95-318b-4397-8dbb-72b52f36f0a2 version: -1 name: Delete Coordinates Context description: |- Delete field from context. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: DeleteContext type: regular iscommand: false brand: "" nexttasks: '#none#': - "9" scriptarguments: all: simple: "no" key: simple: Coordinates separatecontext: false view: |- { "position": { "x": 450, "y": 770 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "22": id: "22" taskid: 4d690d07-5c35-42e4-8da1-3dfc737316f5 type: regular task: id: 4d690d07-5c35-42e4-8da1-3dfc737316f5 version: -1 name: Create Impossible Traveler Events description: Sets a value in context under the key you entered. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "1" scriptarguments: append: simple: "true" key: simple: ImpossibleTraveler.Events value: complex: root: Events filters: - - operator: isEqualString left: value: simple: Events.ip iscontext: true right: value: simple: inputs.sourceip iscontext: true transformers: - operator: StringToArray separatecontext: false view: |- { "position": { "x": 450, "y": -60 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "23": id: "23" taskid: 7157a915-00e4-419b-8d9e-1e3b46bc706a type: regular task: id: 7157a915-00e4-419b-8d9e-1e3b46bc706a version: -1 name: Delete Events Context description: |- Delete field from context. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: - For Cortex XSOAR 6 see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.x/Cortex-XSOAR-Playbook-Design-Guide/Automations - For Cortex XSOAR 8 Cloud see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Create-a-script - For Cortex XSOAR 8.7 On-prem see https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Create-a-script scriptName: DeleteContext type: regular iscommand: false brand: "" nexttasks: '#none#': - "9" scriptarguments: all: simple: "no" key: simple: Events separatecontext: false view: |- { "position": { "x": 50, "y": 770 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "24": id: "24" taskid: 97760e8c-ee4d-4656-8d19-65928cb54fcd type: regular task: id: 97760e8c-ee4d-4656-8d19-65928cb54fcd version: -1 name: Set Country description: Sets a value in context under the key you entered. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "22" scriptarguments: append: simple: "true" key: simple: Events.Country value: complex: root: Coordinates filters: - - operator: isEqualString left: value: simple: Coordinates.query iscontext: true right: value: simple: inputs.sourceip iscontext: true ignorecase: true accessor: countryCode separatecontext: false view: |- { "position": { "x": 840, "y": -230 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "26": id: "26" taskid: 0411b244-1c46-466e-87f7-3f5770571e2f type: regular task: id: 0411b244-1c46-466e-87f7-3f5770571e2f version: -1 name: Set event identity description: Sets a value in context under the key you entered. scriptName: Set type: regular iscommand: false brand: "" nexttasks: '#none#': - "22" scriptarguments: append: simple: "true" key: simple: Events.identity_display_name value: complex: root: alert accessor: username transformers: - operator: FirstArrayElement separatecontext: false view: |- { "position": { "x": 1230, "y": -230 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "27": id: "27" taskid: ea2cf994-dcd6-4756-811f-6ac158487081 type: title task: id: ea2cf994-dcd6-4756-811f-6ac158487081 version: -1 name: Clear Processed Context type: title iscommand: false brand: "" description: '' nexttasks: '#none#': - "21" - "23" - "18" separatecontext: false view: |- { "position": { "x": 450, "y": 630 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "28": id: "28" taskid: ace7b867-75f1-48b0-8a9b-464fdb91d6d2 type: regular task: id: ace7b867-75f1-48b0-8a9b-464fdb91d6d2 version: -1 name: Get IP address verdict description: Retrieve the IP address verdict using the enabled integrations. script: '|||ip' type: regular iscommand: true brand: "" nexttasks: '#none#': - "13" scriptarguments: ip: complex: root: inputs.sourceip separatecontext: false continueonerror: true view: |- { "position": { "x": 450, "y": -730 } } note: false timertriggers: [] ignoreworker: false skipunavailable: true quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "29": id: "29" taskid: 2eb086b8-6cf1-44f4-830f-a1ff14796a85 type: playbook task: id: 2eb086b8-6cf1-44f4-830f-a1ff14796a85 version: -1 name: Account Enrichment - Generic v2.1 description: |- Enrich accounts using one or more integrations. Supported integrations: - Active Directory - SailPoint IdentityNow - SailPoint IdentityIQ - PingOne - Okta - AWS IAM Also, the playbook supports the generic command 'iam-get-user' (implemented in IAM integrations. For more information, visit https://xsoar.pan.dev/docs/integrations/iam-integrations. playbookName: Account Enrichment - Generic v2.1 type: playbook iscommand: false brand: "" nexttasks: '#none#': - "27" scriptarguments: Domain: complex: root: inputs.domain Username: complex: root: inputs.username transformers: - operator: uniq separatecontext: false continueonerrortype: "" loop: iscommand: false exitCondition: "" wait: 1 max: 0 view: |- { "position": { "x": 110, "y": 290 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false system: true view: |- { "linkLabelsPosition": { "1_27_#default#": 0.49 }, "paper": { "dimensions": { "height": 1865, "width": 1951, "x": -340, "y": -865 } } } inputs: - key: sourceip value: {} required: false description: The source IP to iterate over. playbookInputQuery: - key: username value: {} required: false description: The username to iterate over. playbookInputQuery: - key: domain value: {} required: false description: The organization domain. playbookInputQuery: outputs: - contextPath: ActiveDirectory.Users.manager description: The manager of the user. - contextPath: IP description: The IP enrichment results. type: unknown - contextPath: IP.Geo description: The IP geo information. type: unknown - contextPath: IP.Malicious description: The IP verdict. type: unknown - contextPath: AbuseIPDB.IP description: The IP information retrieved from AbuseIPDB. type: unknown - contextPath: AbuseIPDB.IP.Geo description: The IP geo information. type: unknown - contextPath: DBotScore description: The DBotScore type: unknown - contextPath: AbuseIPDB.IP.Malicious description: The IP verdict. type: unknown - contextPath: Account description: The account object. type: unknown - contextPath: ActiveDirectory.Users description: The AD users. type: unknown - contextPath: MSGraphUser description: The user information retrieved from MSGraphUser type: unknown - contextPath: MSGraphUserManager.Manager description: The user's manager information retrieved from MSGraphUser. type: unknown tests: - Test Playbook - Impossible Traveler - Enrichment marketplaces: - marketplacev2 - platform fromversion: 6.6.0 supportedModules: - agentix - cloud - cloud_posture - cloud_runtime_security - edr - xsiam